hash & sm4 & cert(未测试)

src/main/java/minsecurity/certificate/cert/Certificate.java

@@ -0,0 +1,269 @@
+package minsecurity.certificate.cert;
+
+import minsecurity.Common;
+import minsecurity.crypto.HashAlgo;
+import minsecurity.crypto.PrivateKeyInterface;
+import minsecurity.crypto.PublicKeyInterface;
+import minsecurity.crypto.Sm4;
+
+
+import javax.crypto.BadPaddingException;
+import javax.crypto.IllegalBlockSizeException;
+import javax.crypto.NoSuchPaddingException;
+import java.lang.reflect.Array;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.util.Base64;
+
+import static minsecurity.certificate.cert.CertUtils.*;
+
+
+/*
+ * @Author: hongyu guo
+ * @Description:
+ * @Version: 1.0.0
+ * @Date: 17:05 2021/03/05
+ * @Copyright: MIN-Group；国家重大科技基础设施——未来网络北大实验室；深圳市信息论与未来网络重点实验室
+ */
+public class Certificate {
+    private int version;
+    private long serialNumber;
+    private PublicKeyInterface publicKey;
+    private byte[] signature;
+    private int signatureAlgorithm;
+    private int publicKeyAlgorithm;
+    private String issueTo;
+    private String issuer;
+    private long notBefore;
+    private long notAfter;
+    private int keyUsage;
+    private boolean isCA;
+    private long timestamp;
+
+    public Certificate() {
+    }
+
+    public Certificate(int version, long serialNumber,
+                       PublicKeyInterface publicKey,
+                       byte[] signature, int signatureAlgorithm,
+                       int publicKeyAlgorithm,
+                       String issueTo, String issuer,
+                       long notBefore, long notAfter,
+                       int keyUsage, boolean isCA, long timestamp) {
+        this.version = version;
+        this.serialNumber = serialNumber;
+        this.publicKey = publicKey;
+        this.signature = signature;
+        this.signatureAlgorithm = signatureAlgorithm;
+        this.publicKeyAlgorithm = publicKeyAlgorithm;
+        this.issueTo = issueTo;
+        this.issuer = issuer;
+        this.notBefore = notBefore;
+        this.notAfter = notAfter;
+        this.keyUsage = keyUsage;
+        this.isCA = isCA;
+        this.timestamp = timestamp;
+    }
+
+    public int getVersion() {
+        return version;
+    }
+
+    public void setVersion(int version) {
+        this.version = version;
+    }
+
+    public long getSerialNumber() {
+        return serialNumber;
+    }
+
+    public void setSerialNumber(long serialNumber) {
+        this.serialNumber = serialNumber;
+    }
+
+
+    public byte[] getSignature() {
+        return signature;
+    }
+
+    public void setSignature(byte[] signature) {
+        this.signature = signature;
+    }
+
+    public int getSignatureAlgorithm() {
+        return signatureAlgorithm;
+    }
+
+    public void setSignatureAlgorithm(int signatureAlgorithm) {
+        this.signatureAlgorithm = signatureAlgorithm;
+    }
+
+    public int getPublicKeyAlgorithm() {
+        return publicKeyAlgorithm;
+    }
+
+    public void setPublicKeyAlgorithm(int publicKeyAlgorithm) {
+        this.publicKeyAlgorithm = publicKeyAlgorithm;
+    }
+
+    public String getIssueTo() {
+        return issueTo;
+    }
+
+    public void setIssueTo(String issueTo) {
+        this.issueTo = issueTo;
+    }
+
+    public String getIssuer() {
+        return issuer;
+    }
+
+    public void setIssuer(String issuer) {
+        this.issuer = issuer;
+    }
+
+    public long getNotBefore() {
+        return notBefore;
+    }
+
+    public void setNotBefore(long notBefore) {
+        this.notBefore = notBefore;
+    }
+
+    public long getNotAfter() {
+        return notAfter;
+    }
+
+    public void setNotAfter(long notAfter) {
+        this.notAfter = notAfter;
+    }
+
+    public int getKeyUsage() {
+        return keyUsage;
+    }
+
+    public void setKeyUsage(int keyUsage) {
+        this.keyUsage = keyUsage;
+    }
+
+    public boolean isCA() {
+        return isCA;
+    }
+
+    public void setCA(boolean CA) {
+        isCA = CA;
+    }
+
+    public long getTimestamp() {
+        return timestamp;
+    }
+
+    public void setTimestamp(long timestamp) {
+        this.timestamp = timestamp;
+    }
+
+    public PublicKeyInterface getPublicKey() {
+        return publicKey;
+    }
+
+    public void setPublicKey(PublicKeyInterface publicKey) {
+        this.publicKey = publicKey;
+    }
+
+
+    public void signCert(PrivateKeyInterface priv) throws Exception {
+        InnerCertificate inner = CertUtils.parseCertToInnerCert(this);
+        byte[] bytesOfCert = serialization(CertUtils.parseCertToInnerCert(this));
+        switch (this.signatureAlgorithm){
+            case Common.SM3withSM2:
+                // byte[] digest = HashAlgo.sm3(bytesOfCert);
+                byte[] sign = priv.sign(bytesOfCert);
+                this.signature = sign;
+                return;
+            default:
+                throw new Exception("未定义的签名方法");
+        }
+    }
+
+    public boolean verifyCert(Certificate ca, Certificate sub) throws Exception {
+        InnerCertificate innerCertificate = CertUtils.parseCertToInnerCert(sub);
+        switch (innerCertificate.getTbsCertificate().getVersion()){
+            case CertUtils.VERSION1:
+                boolean isValid = CertUtils.checkDuration(innerCertificate);
+                if(!isValid)
+                    return false;
+                if(sub.isCA()){
+                    return checkSign(innerCertificate, sub.getPublicKey());
+                } else {
+                    return checkSign(innerCertificate, ca.getPublicKey());
+                }
+            default:
+                return false;
+        }
+    }
+
+    public String toPem(byte[] passwd, int symAlgoMode) throws CertException, NoSuchPaddingException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, IllegalBlockSizeException, BadPaddingException, NoSuchProviderException, InvalidKeyException {
+        if(this.getSignature() == null){
+            throw new CertException("该证书未签名");
+        }
+        byte[] bytesOfCert = serialization(CertUtils.parseCertToInnerCert(this));
+        byte[] ret = new byte[0];
+        if(passwd.length > 0){
+            byte[] hashPasswd = HashAlgo.sm3(passwd);
+            if( hashPasswd.length == 32){
+                for(int i = 0; i < 16; i++){
+                    hashPasswd[i] += hashPasswd[i + 16];
+                }
+            }
+            byte[] sm4Key = new byte[16];
+            System.arraycopy(hashPasswd,0,sm4Key,0,16);
+
+            switch (symAlgoMode){
+                case Common.SM4CBC:{
+                    // TODO: PADDING???  IV?????
+                    ret = Sm4.encrypt_CBC_NoPadding(sm4Key, new byte[16],bytesOfCert);
+                }
+                case Common.SM4ECB:{
+                    ret = Sm4.encrypt_ECB_NoPadding(sm4Key, bytesOfCert);
+                }
+                default:
+                    throw new CertException("未定义的对称加密算法");
+            }
+        } else {
+            ret = bytesOfCert;
+        }
+        return Base64.getEncoder().encodeToString(ret);
+    }
+
+    public Certificate fromPem(String pemString, byte[] passwd, int symAlgoMode) throws CertException, BadPaddingException, NoSuchPaddingException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, IllegalBlockSizeException, NoSuchProviderException, InvalidKeyException {
+        if(pemString == null || pemString.equals("")){
+            throw new CertException("pem串为空");
+        }
+        byte[] bytesOfPem = Base64.getDecoder().decode(pemString);
+        byte[] bytesOfCert = new byte[0];
+        if(passwd.length > 0){
+            byte[] hashPasswd = HashAlgo.sm3(passwd);
+            if( hashPasswd.length == 32){
+                for(int i = 0; i < 16; i++){
+                    hashPasswd[i] += hashPasswd[i + 16];
+                }
+            }
+            byte[] sm4Key = new byte[16];
+            System.arraycopy(hashPasswd,0,sm4Key,0,16);
+
+            switch (symAlgoMode){
+                case Common.SM4CBC:
+                    bytesOfCert =  Sm4.decrypt_CBC_Padding(sm4Key,new byte[16], bytesOfPem);
+                case Common.SM4ECB:
+                    bytesOfCert =  Sm4.decrypt_ECB_Padding(sm4Key, bytesOfPem);
+            }
+        } else {
+            bytesOfCert = bytesOfPem;
+        }
+        InnerCertificate innerCertificate = deserialization(bytesOfCert);
+        return CertUtils.parseInnerCertToCert(innerCertificate);
+    }
+
+}